問題文
A team finds malicious activity only through the alerts its monitoring products raise, and it stores just enough data to keep those products running. Where does this capability sit in the hunting maturity model?
選択肢
- At the innovative level, where the analysis that other teams later borrow is worked out in house.
- At the procedural level, where a hunt written up by somebody else is run against the estate on a regular footing.
- At the minimal level, where indicators lifted from a fresh report can be run against the records already held.
- At the initial level, where the stored data would not carry a search even if a skilled hunter had been hired tomorrow.